<html>
<head><meta charset="utf-8"><title>pointer comparisons · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html">pointer comparisons</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="165076089"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/165076089" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Wanja Hentze <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#165076089">(May 07 2019 at 14:31)</a>:</h4>
<p>So I do realize that, in C, comparing pointers that are not from the same allocation is undefined behavior.<br>
In Rust, arbitrary pointers can be compared safely using either Eq or Ord.<br>
But if I run that code in miri, I get an error.<br>
Does that mean that comparisons of unrelated pointers are secretly UB? Or is this just something miri can not reason about?</p>



<a name="165076442"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/165076442" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Wanja Hentze <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#165076442">(May 07 2019 at 14:35)</a>:</h4>
<p>More concretely, should I be able to write the following function without UB?<br>
<code>fn is_in_bounds(ptr: *const T, slice: *const [T])</code></p>



<a name="165108232"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/165108232" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#165108232">(May 07 2019 at 20:31)</a>:</h4>
<blockquote>
<p>But if I run that code in miri, I get an error.</p>
</blockquote>
<p>That is a limitation of Miri, not an indication of UB. The issues for that is <a href="https://github.com/rust-lang/miri/issues/224" target="_blank" title="https://github.com/rust-lang/miri/issues/224">https://github.com/rust-lang/miri/issues/224</a>.</p>



<a name="165108314"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/165108314" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#165108314">(May 07 2019 at 20:32)</a>:</h4>
<p>ptr comparison between any two pointers is safe in Rust.</p>



<a name="165108335"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/165108335" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#165108335">(May 07 2019 at 20:32)</a>:</h4>
<p>there are some thorny questions around specifying that precisely though :/</p>



<a name="190486930"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190486930" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190486930">(Mar 13 2020 at 09:58)</a>:</h4>
<p>I have a question in the same line of thought.<br>
Because in rust we disallow this: <code>let a: [u8]; let ptr1: *const u8 = &amp;a[0]; let a1 = unsafe {*ptr1.offset(1)};</code> (we require you to get a pointer to the whole slice).<br>
do we even promise that <code>let a: [u8]; let ptr1: *const u8 = a.as_ptr().wrapping_add(1); let ptr2 = &amp;a[1]; assert_eq!(ptr1, ptr2);</code>?<br>
I thought about that while reading <a href="https://blog.frondeus.pl/parser-1/" target="_blank" title="https://blog.frondeus.pl/parser-1/">https://blog.frondeus.pl/parser-1/</a> which in their he calculates pointer offsets a lot and I wonder if we promise that two pointers to the same "object" are always equivalent even if you obtain them in different ways, and they have different validity requirements.</p>



<a name="190641223"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190641223" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190641223">(Mar 15 2020 at 10:40)</a>:</h4>
<p>uh wow talk about stream necromancy^^</p>



<a name="190641229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190641229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190641229">(Mar 15 2020 at 10:41)</a>:</h4>
<p>we've implemented ptr-int-casts since the original qustion, so basically everything about it changed</p>



<a name="190641325"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190641325" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190641325">(Mar 15 2020 at 10:42)</a>:</h4>
<p><span class="user-mention" data-user-id="249222">@Elichai Turkel</span> that's a good question, and I would formally state it has "how much does pointer provenance affect pointer comparison"</p>



<a name="190641328"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190641328" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190641328">(Mar 15 2020 at 10:42)</a>:</h4>
<p>I would hope that the stacked borrow tag does not affect comparison, and I <em>think</em> that reflects what LLVM dos, but since LLVM is very unsound around ptr-int casts, that's hard to say for sure.</p>



<a name="190641340"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190641340" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190641340">(Mar 15 2020 at 10:43)</a>:</h4>
<p>other provenance, like the original allocation the pointer "comes from", certainly <em>can</em> affect ptr comparison in LLVM</p>



<a name="190641353"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer%20comparisons/near/190641353" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/pointer.20comparisons.html#190641353">(Mar 15 2020 at 10:43)</a>:</h4>
<p>that <em>should</em> mean that casting ptrs to integers and comparing those is actually a different operation than comparing the pointers. unfortunately LLVM will optimize the former to the latter. which is wrong (part of the unsoundness I mentioned).</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>